Hacker News new | past | comments | ask | show | jobs | submit
> This year is going to be different. PostgreSQL 19 most likely won’t be released until November… […] So, what happened? The short answer is that LLMs happened. […] There’s a huge amount of code, and that code contains a huge number of bugs. […] What’s different now is that it’s become vastly easier to find those bugs.

This seems…good?

That it might disrupt the project's "traditional" release cadence a bit doesn't seem terribly bad in light of the alternative, which is shipping another major update with bugs which have apparently haunted the codebase for some time.

At work we have put a full halt on feature work because the number of security related tasks has become staggering and urgent.

We will hopefully get over this wave and be able to move forward with much more secure software, but it's crazy right now.

We’ve also been blowing a lot of retainer hours just patching sites instead of building new features. It sucks. Ultimately going to cost clients more.
loading story #50334309
loading story #50334364
loading story #50334080
How did you get product management to agree to that? Ours said "I could fix all of that in 2 days with Claude." They are still not fixed. Granted, our PMs suck.
loading story #50333805
loading story #50333900
{"deleted":true,"id":50332496,"parent":50332447,"time":1793587284,"type":"comment"}
It’s amazing how much slop humans have produced that now needs to be fixed by AI…
loading story #50333882
Interesting that this could result in net negative software productivity world wide in terms of features right now.

LLMs finding unpatched vulnerabilities faster than they can be reasonably patched, bringing all other software development to a halt.

That's only if you consider security to be unproductive!

If you consider it to be productive work, it's a massive productivity boon happening right now. Of course, product managers might disagree...

loading story #50333081
loading story #50332950
loading story #50334104
loading story #50332910
Depends on the layers you are working on. Security is top priority on a lot of things that are visible to the internet, but in a lot of large companies, the footprint of the whole org is so much larger that than, and there many companies are deferring many security issues. So then you see a lot of speed there, when the consumer accessible systems are the focus of the security push.
Hopefully with the amount of visibility LLMs are bringing to the situation, security will finally be considered a first-class feature
loading story #50333148
loading story #50333429
i think we have a pretty high p(doom) on frontier ai escaping containment with their weights and goes hack everything, if we do not act now we may have no chance to act anymore.
loading story #50332987
> This seems…good?

You would think so but medicine has faced this paradox since the development of modern testing technology.

You would naively think more testing is always better. More sophisticated practitioners then talk about Type I vs Type II errors and the problem of false positives.

But even if you were able to come up with tests that had 100% accuracy, there are times when you don't want to run that test on someone. The key distinction is that people only ever die of one thing and having a tumor that doesn't kill them is often better than risking the surgery to remove the tumor.

Similarly, there are some bugs you don't want to find since the harm from the people it affects is smaller than the opportunity cost of fixing it. Ignorance of the bug is better than knowing about it and having to make an affirmative decision not to fix it.

loading story #50333562
loading story #50334164
loading story #50333856
loading story #50333567
loading story #50333642
This is great for the same reason open source software is great.

We want software that remains robust in the long term, so that even when people are able to inspect the source code, it's still solid, rather than hiding the source code and hoping people don't find holes everywhere.

I think it will be annoying in the short term, but the cleanup this causes will be a good thing in the long term (and of course LLMs can also help with fixing bugs, even without source code.)
Exactly. There's so much negativity, it sometimes borders Luddism.

"We found a bunch of ways to make our product safer and better. We need more time to ship a higher quality product."

PICKET SIGNS

Luddites were actually pretty reasonable when you dig into it. Maybe shouldn't be using it as an insult?
They're reasonable in a self-interested net-negative game-theory kind of way, yes. But that doesn't make it a good idea for society.
loading story #50333696
loading story #50333912
loading story #50333476
> Luddites were actually pretty reasonable when you dig into it.

No, they were not. The problems they faced were absolutely real, but the solutions they chose to attempt were stupid and counterproductive. Which is why they lost so hard, and it was not even a contest.

Socialism movement that refused to use machines and factories would inevitably lose to capitalists that embraced them.

Socialism movement that refuses to use AI will inevitably lose to capitalists that embrace it.

loading story #50333935
For their own personal interests. Not for those of society
loading story #50333463
RTFA

> In the end, I don’t think that the delay in shipping PostgreSQL 19 is particularly concerning. It is not a long delay in the grand scheme of things, and it emerges directly from the project’s concern for quality.

Luddism, did not expect to ever hear that word with Postgres development :>
We could really use a lot more luddites tbh. Doesn't seem very applicable here tho.
Dont worry, if OpenAI and Anthropic have their way and everyone loses their jobs to AI, we're all becoming luddites.
loading story #50333569
Did you honestly need a /sarcasm tag in the article?

The article also concludes that overall, yes, finding more bugs is a good thing. Basically saying it’s the LLMs “fault” that the quality is improving, alongside a slight delay to the release.

They found a more efficient way to play Whac-A-Mole with bugs, they didn't find a way to reduce bugs.
It’s a good article. Easy to read. You should read it.
loading story #50333009
Indeed, we did a whole release consisting only of an AI security scan of the codebase plus fixes.
This is good. This is how I would expect llms to affect a codebase. Nothing sucks more than having a coworker put out a code review but your codex immediately finds problems. Run llm/self reviews against your code before you have other humans review it. It is common courtesy.
Yes, exactly. The only question I have is whether the delay is attributable to high-quality bug reports or the burden of triaging low-quality ones. It's not completely clear which situation they're experiencing.
It’s pretty clear there are a lot of valid reports based on the large increase in backport commits cited.
loading story #50332173
I'd imagine just as every other project, both.
likely both
loading story #50332343
loading story #50331922